Red Hat Security Advisory

RHSA-2009:1562

tomcat security update

Released 2009-11-09 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Application Server v2 4AS tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8
Red Hat Application Server v2 4ES tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8
Red Hat Application Server v2 4WS tomcat5-5.5.23-0jpp_4rh.16, tomcat5-admin-webapps-5.5.23-0jpp_4rh.16, tomcat5-common-lib-5.5.23-0jpp_4rh.16 +8

Fixes 6 records

TI-2009-00557 CVE-2009-0580 · GHSA-w227-xcfx-3pj8

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when…

MEDIUM 64

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when FORM authentication is used, allows remote attackers to enumerate valid usernames via requests to /j_security_check with malformed…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.9444 Published 2009-06-05 Fixed in 4.1.40, 5.5.28 +1 CWE-200

TI-2007-05131 CVE-2007-5333 · GHSA-cww4-vj5r-rx57

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does…

MEDIUM 58

Apache Tomcat 6.0.0 through 6.0.14, 5.5.0 through 5.5.25, and 4.1.0 through 4.1.36 does not properly handle (1) double quote (") characters or (2) %5C (encoded backslash) sequences in a cookie value, which might cause se…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.62575 Published 2008-02-12 Fixed in 6.0.15, 5.5.26 +1 CWE-200

TI-2008-05231 CVE-2008-5515 · GHSA-9737-qmgc-hfr9

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and…

MEDIUM 41

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, 6.0.0 through 6.0.18, and possibly earlier versions normalizes the target pathname before filtering the query string when using the RequestDispatcher method, whic…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.18685 Published 2009-06-16 Fixed in 4.1.40, 5.5.28 +1 CWE-22

TI-2009-00033 CVE-2009-0033 · GHSA-5cw4-ggx9-36vg

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when…

LOW 35

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18, when the Java AJP connector and mod_jk load balancing are used, allows remote attackers to cause a denial of service (application outage…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.10053 Published 2009-06-05 Fixed CWE-20

TI-2009-00746 CVE-2009-0781 · GHSA-j788-fx57-99wp

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application…

LOW 32

Cross-site scripting (XSS) vulnerability in jsp/cal/cal2.jsp in the calendar application in the examples web application in Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 allows remote…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.09719 Published 2009-03-09 Fixed in 6.0.20 CWE-79

TI-2009-00747 CVE-2009-0783 · GHSA-hhjg-g8xq-hhr3

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18…

LOW 21

Apache Tomcat 4.1.0 through 4.1.39, 5.5.0 through 5.5.27, and 6.0.0 through 6.0.18 permits web applications to replace an XML parser used for other web applications, which allows local users to read or modify the (1) web…

CVSS 3.0MEDIUM 4.2 Local High privileges No interaction EPSS 0.00809 Published 2009-06-05 Fixed in 6.0.20 CWE-200